Under cygwin, winsock2.h is intentionally incompatible with,
<sys/socket.h>, and checking for existence is wrong.

Under mingw, HAVE_WINSOCK2_H is defined on our behalf by
gnulib, in a way that does not interfere with cygwin.

* configure.ac: Drop unnecessary header check.
Reported by Matthias Bolte.

It's not needed and is currently ignored, but this is a bug.

It will get fixed soon and QMP will return an error for keys
it doesn't know about, this will break libvirt.

* src/qemu/qemu_monitor_json.c: remove qemuMonitorJSONCommandAddTimestamp()
  and the place where it's invoked in qemuMonitorJSONMakeCommand()

I am extending the schema with the recently added connlimit-above
attribute and adding a test case for it to the test suite.

* AUTHORS: Use preferred name.
Signed-off-by: NEric Blake <eblake@redhat.com>

The nwfilterDriverActive() could de-reference a NULL pointer
if it hadn't be started at the point it was called. It was
also not thread safe, since it lacked locking around data
accesses.

* src/nwfilter/nwfilter_driver.c: Fix locking & NULL checks
  in nwfilterDriverActive()

The user probably doesn't care what the gai error numbers are, as
much as what the failed conversion IP address was.

* src/remote/remote_driver.c (addrToString): Mention which address
could not be converted.
* daemon/remote.c (addrToString): Likewise.

git shortlog $(git log -1 --format=%H AUTHORS).. | grep -v "^ "

then add missing entries to AUTHORS.

* AUTHORS: Update.

* The error messages coming from qemu's DAC support contain strings
  from the original SELinux security driver code.  This just removes
  references to "security context" and other SELinux-isms from the DAC
  code.
Signed-off-by: NSpencer Shimko <sshimko@tresys.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

 - using INT_BUFSIZE_BOUND() to determine the length of the buffersize
for printing and integer into

 - not explicitly initializing static var threadsTerminate to false
anymore, since that's done automatically

Changes after V2:
  - removed while looks in case of OOM error
  - removed on ifaceDown() call
  - preceding one ifaceDown() call with an ifaceCheck() call

Since the name of an interface can be the same between stops and starts
of different VMs I have to switch the IP address learning thread to use
the index of the interface to determine whether an interface is still
available or not - in the case of macvtap the thread needs to listen for
traffic on the physical interface, thus having to time out periodically
to check whether the VM's macvtap device is still there as an indication
that the VM is still alive. Previously the following sequence of 2 VMs
with macvtap device

virsh start testvm1; virsh destroy testvm1 ; virsh start testvm2

would not terminate the thread upon testvm1's destroy since the name of
the interface on the host could be the same (i.e, macvtap0) on testvm1
and testvm2, thus it was easily race-able. The thread would then
determine the IP address parameter for testvm2 but apply the rule set
for testvm1. :-(
I am also introducing a lock for the interface (by name) that the thread
must hold while it listens for the traffic and releases when it
terminates upon VM termination or 0.5 second thereafter. Thus, the new
thread for a newly started VM with the same interface name will not
start while the old one still holds the lock. The only other code that I
see that also needs to grab the lock to serialize operation is the one
that tears down the firewall that were established on behalf of an
interface.

I am moving the code applying the 'basic' firewall rules during the IP
address learning phase inside the thread but won't start the thread
unless it is ensured that the firewall driver has the ability to apply
the 'basic' firewall rules.

* Fix for the bug reported at:

https://bugzilla.redhat.com/show_bug.cgi?id=573908

The hang fix in d376b7d6 was incomplete
since it left quite a few {Enter,Exit}Monitor calls which require driver
to be unlocked. Since the driver is locked throughout the whole
function, {Enter,Exit}MonitorWithDriver need to be used instead to
ensure driver is not locked when issuing monitor commands.

The comment in qemuDomainWaitForMigrationComplete says we are polling
every 50ms but the code sleeps only for 50us. This was already discussed
during review but apparently forgotten when the series was pushed.

* Fix a logic error in configure.ac that prevented --with-selinux=no
  from being used with --with-secdriver-selinux=no.

* Fix some strings to clarify the difference between --with-selinux
  and --with-secdriver-selinux.
Signed-off-by: NSpencer Shimko <sshimko@tresys.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

The text monitor code was checking for a '\n' prefix on several
places. Previously this would work, but since the monitor code
re-write the '\n' is already stripped off, so mustn't be checked
for.

* src/qemu/qemu_monitor_text.c: Fix monitor error checking

Probably as a result of a merge error, the CPU hotplug command
names were completely wrong.

* src/qemu/qemu_monitor_json.c, src/qemu/qemu_monitor_text.c: Fix
  the CPU hotplug command names

The events demo program is slightly misleading printing

  myDomainEventCallback1 EVENT: Domain f14i686(-1) Added

which is not distinguishing Add vs Update events. It should have
been doing

  myDomainEventCallback1 EVENT: Domain f14i686(-1) Defined Updated

* examples/domain-events/events-python/event-test.py: Fully print
  event detail info string

A few fixes will help make tools/virt-pki-validate.in useful on Debian
and Ubuntu.  And one fix should be useful to everyone (see #3).

 1) note our gnutls-bin package (in addition to your gnutls-utils
package) in the no-certtool error text

 2) fix a bashism, == should be = in the case where /bin/sh is a symlink
to dash

 3) $(SYSCONFDIR) cannot evaluate; set a single shell SYSCONFDIR
variable to the autoconf @SYSCONFDIR@ value, and use $SYSCONFDIR
everywhere

Bug report:
 * https://bugs.edge.launchpad.net/ubuntu/+source/libvirt/+bug/562266Signed-off-by: NDustin Kirkland <kirkland@canonical.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

Noticed because virt-pki-validate was very inconsistent on
using tabs vs. 8 spaces, sometimes mixing both paradigms on
a single line.

'git diff -b' shows significant changes only in cfg.mk.

* cfg.mk (sc_TAB_in_indentation): Add a few files.
* daemon/libvirtd.init.in: Avoid tabs.
* tools/virt-pki-validate.in: Likewise.

* tests/testutilsqemu.c (testQemuCapsInit): Initialize variables.

Adds ability to provide a preferred CPU model for CPUID data decoding.
Such model would be considered as the best possible model (if it's
supported by hypervisor) regardless on number of features which have to
be added or removed for describing required CPU.

So far, when CPUID data were converted into CPU model and features, the
features can only be added to the model. As a result, when a guest asked
for something like "qemu64,-svm" it would get a qemu32 plus a bunch of
additional features instead.

This patch adds support for removing feature from the base model.
Selection algorithm remains the same: the best CPU model is the model
which requires lowest number of features to be added/removed from it.

Qemu committed a patch which list some CPU names in [] when asked for
supported CPUs (qemu -cpu ?). Yet, it needs such CPUs to be passed
without those square braces. When probing for supported CPU models, we
can just strip the square braces and pretend we have never seen them.

First, inital VCPU pinning is set correctly but then it is reset by
assigning qemu process to a new cgroup (which contains all CPUs). It's
easily fixed by swapping these two actions.

* .gitignore: Add exemption.
* cfg.mk (local-checks-to-skip): Ignore a test to silence a skip
warning.

If the hostname of the current virtualization machine
could not be resolved, then libvirtd would fail to
start.  However, for disconnected operation (on a laptop,
for instance) the hostname may very legitimately not
be resolvable.  This patch makes it so that if we can't
resolve the hostname, avahi doesn't fail, it just uses
a less useful MDNS string.
Signed-off-by: NChris Lalancette <clalance@redhat.com>

Fixes http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578347

* src/esx/esx_vi.h: Placate cppi.

An empty root snapshot list was considered as error condition. Creating a
new snapshot would fail if the domain didn't have snapshots yet, because
the snapshot-create function tries to lookup the list of existing snapshots
in order to verify that the snapshot name is unique. This fails if the
domain doesn't have snapshots yet.

Removing the NULL check from esxVI_LookupRootSnapshotTreeList fixes this.

FindByIp may return nothing if there is no host or virtual machine
with the given IP address. Handle that case properly.

The supported virtualHW.version doesn't depend on the API version,
but on the product version.

This patch adds support for the connlimit match in iptables that is used
to limit the number of outgoing directions.

I am moving some of the eb/iptables related functions into the interface
of the firewall driver and am making them only accessible via the driver's
interface. Otherwise exsiting code is adapted where needed. I am adding one
new function to the interface that checks whether the 'basic' rules can be
applied,  which will then be used by a subsequent patch.

According to GCC, ATTRIBUTE_UNUSED means that an attribute _might_
be unused, not _must_ be unused.  Therefore, it is easier to
blindly mark a variable, than to try and do preprocessor limiting
of when we know it is unused.

* src/remote/remote_driver.c (remoteAuthenticate): Mark attribute
as potentially unused.
Reported by Gustovo Morozowski.

No semantic change, the now explicitly set default are all zero and
that's what GCC sets unspecified struct members to.

Add a test case and document it.

Otherwise compiling with -Werror will fail.

During an out-of-tree build, the current working directory is the build
directory. Since the FILTERS are static and not modified or
auto-generated during the build process, they need to be explicitly
fetched from the source directory during install.

Prefix the files with $(srcdir), which gets expanded to the absolute or
relative path to the source directory, even when duing out-of-tree
builds.
Signed-off-by: NPhilipp Hahn <hahn@univention.de>